Tenda FH1201 Stack-Based Buffer Overflow Vulnerability in SetIpBind Function

A stack-based buffer overflow vulnerability has been identified in the Tenda FH1201 router, specifically in the firmware version 1.2.0.14(408). The vulnerability arises in the SetIpBind function, where excessive data in the 'page' parameter leads to a buffer overflow during the processing of HTTP requests. This flaw can be exploited remotely, potentially allowing attackers to execute arbitrary code or cause a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending an HTTP request to the '/goform/SetIpBind' endpoint with a 'page' parameter that contains excessive data. This can be done using a simple script that automates the process of sending the malformed request.